Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

lrosen (attorney Lawrence Rosen) writes with a response to an article that appeared on Opensource.com late last month, detailing a court case that arose between Versata Software and Ameriprise Financial Services; part of the resulting dispute hinges on Versata's use of GPL'd software (parsing utility VTD-X, from Ximpleware), though without acknowledging the license. According to the article's author, attorney Aaron Williamson (former staff attorney for the Software Freedom Law Center), "Lawyers for commercial software vendors have feared a claim like this for essentially the entire 20-odd-year lifetime of the GPL: a vendor incorporates some GPL-licensed code into a product—maybe naively, maybe willfully—and could be compelled to freely license the entire product as a result. The documents filed by Amerprise in the case reflect this fearful atmosphere, adopting the classically fear-mongering characterization of the GPL as a 'viral' license that 'infects' its host and 'requires it to become open source, too.'" Rosen writes: I want to acknowledge Aaron's main points: This lawsuit challenges certain assumptions about GPLv2 licensing, and it also emphasizes the effects of patents on the FOSS (and commercial) software ecosystem. I also want to acknowledge that I have been consulted as an expert by the plaintiff in this litigation (Ximpleware vs. Versata, et al.) and so some of what I say below they may also say in court.
Read on for the rest (and Williamson's article, too, for a better understanding of this reaction to it). An important take-away: it's not just the license that matters.

tester data

Let's be open about the facts here. Ximpleware worked diligently over many years to create certain valuable software. The author posted his source code on SourceForge. He offered the software under GPLv2. He also offered that software under commercial licenses. And he sought and received and provided notice of United States patent claims related to that software.

Unbeknownst to Ximpleware, Versata took that GPLv2 software and incorporated it into Versata products – without disclosing that GPLv2 software or in any other way honoring the terms of the GPLv2 license. The reason Ximpleware became aware of that GPLv2 breach is because some months ago Versata and one of its customers, Ameriprise, became embroiled in their own litigation. The breach of GPLv2 came out during discovery.

Ximpleware has terminated that license as to Versata. This is exactly what the Software Freedom Conservancy and others do when confronted by GPL breaches.

That earlier litigation is between two (or more) commercial companies; it is not a FOSS problem. These are mature, sophisticated, profitable companies that have the wherewithal to protect themselves. I know in my own law practice, whether I represent software vendors or their commercial customers, we typically provide for some level of indemnification. Perhaps Ameriprise and the other customer-defendants can count on Versata defending them against Ximpleware. Such a commercial dispute between big companies – even if it involves the GPLv2 software of a small company and separate indemnification for copyright or patent infringement – is between them alone.

But as to Ximpleware and its GPLv2 copyrighted and patented software, there are a few misunderstandings reflected in Aaron Williamson's article:

1. The notion of "implied patent licensing" has no clear legal precedent in any software licensing. While it is true that goods one purchases include a patent license under what is known as the "exhaustion doctrine," there is no exhaustion of patented software when copies are made (even though copying of the software itself is authorized by GPLv2). For example, a typical commercial patent license nowadays might include a royalty for each Android phone manufactured and sold. Companies that distribute Android phones and its FOSS software acquire patent licenses so recipients of their phones are indeed free to use those phones. But that isn't because of some implied patent licenses that come with Android software, but because commercial companies who distribute phones pay for those patent rights, directly or indirectly. I think it is entirely reasonable to require commercial companies to get their patent licenses in writing.

2. Versata's customers who received the (in breach!) GPLv2 software all moved to dismiss Ximpleware's infringement claims against them, pointing to Section 0 of GPLv2, which says, "[t]he act of running the Program is not restricted." What that sentence actually means is just what it says: The GPLv2 copyright grant itself (which is all there is in GPLv2) does not restrict the act of running the program. Nor could it; that is a true statement because running a program is not one of the enumerated copyright rights subject to a copyright license (17 USC 106). The authors of the GPL licenses have themselves made that argument repeatedly: The use of software is simply not a copyright issue.

3. Because there are U.S. patent claims on this Ximpleware software, Section 7 of GPLv2 prohibits its distribution under that license in the United States (or any jurisdictions where patent claims restrict its use). If Ameriprise and the other defendants were outside the U.S. where the Ximpleware patents don't apply, then GPLv2 would indeed be sufficient for that use. But inside the U.S. those customers are not authorized and they cannot rely on an assumed patent grant in GPLv2. Otherwise GPLv2 Section 7 would be an irrelevant provision. Reread it carefully if you doubt this.

The Versata customers certainly cannot depend on an implied patent license received indirectly through a vendor who was in breach of GPLv2 since the beginning – and still is! Versata ignored and failed to disclose to its own customers Ximpleware's patent notices concerning that GPLv2 software, but those patents are nevertheless infringed.

Should we forgive commercial companies who fail to undertake honest compliance with the GPL? Should we forgive their customers who aren't diligent in acquiring their software from diligent vendors?

As Aaron Williamson suggests, we shouldn't ignore the implications of this case. After all, the creator of Ximpleware software made his source code freely available under GPLv2 and posted clear notices to potential commercial customers of his U.S. patents and of his commercial licensing options. Lots of small (and large!) open source commercial companies do that. Although it is ultimately up to the courts to decide this case, from a FOSS point of view Ximpleware is the good guy here!

There is rich detail about this matter that will come out during litigation. Please don't criticize until you understand all the facts.

Indeed. I fail to see why GPL software is being picked on here. You lift someone else's copyrighted code without permission and without abiding by any licensing agreements, you are SOL if you get busted.

Indeed. I fail to see why GPL software is being picked on here. You lift someone else's copyrighted code without permission and without abiding by any licensing agreements, you are SOL if you get busted.

I think it's the nightmare scenario.

You have program A. You contract vendor B to add feature C to program A. Unbeknownst to you, vendor B took GPL code D to implement feature C, making program A now GPL, unknown to you because vendor B took GPL'd code to add feature C.

You may cure that infringment a number of ways, including: stripping the infringing code, paying the authors for an alternative license, pay the authors what the court orders you to pay them and, yes, releaseing program A under the GPL. The point is, how you cure the infringement is up to you. The GPL does not automatically attach to your code and if push comes to shove the court will order monetrary damages not compulsory licensing.

+1 - A lot of folks are playing amateur lawyer and making claims about what the GPL "does", but you should defer to Rosen here since he actually is a practicing lawyer who has actually been at a Plaintiff's table and enforced the GPL. He is very explicit that the GPL does not create new obligations upon authors who combine original works with GPL works. Your code is always your code, regardless of whether it is in a separate C file, or patched into an existing file licensed to you under the GPL. Go back and

the GPL does not create new obligations upon authors who combine original works with GPL works.

That isn't true either. If you accept license to the GPL'd work, you're bound by the terms of that license, which includes providing the source for the combined work to anyone to whom you also provide the binary. The terms of the license can be enforced against you by anyone the license empowers to do so -- namely anybody to whom you directly provided the binary code.

In tlhIngan's scenario, you never knew about the GPL'd work thus could not have agreed to the license. That makes it unwitting infringement --

The GPL doesn't proscribe that "You must GPL the end result" it says that you are infringement and must not distribute. The way out is to GPL or hash out some agreement with the Licensors (GPL authors) of some sort, but relicensing simply is not automatic, as frusturating as it might seem.

In the time between the authors filing a suit and the court entering a judgement you can write your way around any GPL infringement that isn't your whole product. After which you take your lumps for the past activity... which amounts to paying the authors who sued.

True but this is not specific to GPL at all. What has happened is company A bought code from company B and company B did not have all the correct permissions and licenses under both copyright and patent law to sell that code to them. It's true that company A is now stuck because they cannot sell any product which includes that code but this would be true regardless of whether company B violated the GPL or other license.

If anything company A has more options with the GPL that they would with a proprietar

GPL isn't the relevant part of the nightmare though. It is no less harmful if B takes per-instance proprietary library D and links it to A. You are now potentially on the hook for more than each copy of A was sold for.

The difference is that the code is distributed for free. No judge is going to award damages for the redistribution of something that is free. At least, not actual damages, like $$$ per infringing copy. The breach of the terms (like not redistributing the source code) could be translated to some punitive damages, perhaps. Probably the best outcomes you can hope for are: the violator of the license is either asked to stop distributing the software, or else to come into compliance: replace the GPL'ed part with

The difference is that the code is distributed for free. No judge is going to award damages for the redistribution of something that is free. At least, not actual damages, like $$$ per infringing copy. The breach of the terms (like not redistributing the source code) could be translated to some punitive damages, perhaps.

I don't see how the lack of a monetary cost for _one_ of the licensing options should affect awarding damages.

Probably the best outcomes you can hope for are: the violator of the license is either asked to stop distributing the software, or else to come into compliance: replace the GPL'ed part with a from-scratch workalike, so that the program is no longer distributed with any GPLed code, or else make the whole program GPLed.

You forgot the third option in this case. If Ximpleware is open to it, they could pay for a commercial license.

Indeed. This is no different from distributing, say, a copy of Oracle's database with your code without a licensing deal. They don't require a key code to install or run it - you can download, install and run it, but without paying $17k per processor, you are in violation of their copyright.

The code wasn't distributed for free. It was distributed under a choice of two separate licenses: One was the GPL, one was commercial. Clearly, the commercial license route wasn't taken, and the GPL license wasn't adhered to.

The code wasn't distributed for free. It was distributed under a choice of two separate licenses: One was the GPL, one was commercial. Clearly, the commercial license route wasn't taken, and the GPL license wasn't adhered to.

Irrelevant if the patent owners argument is accepted that the GPL license did not include a license to use the software because you also needed to obtain a license for the patent that the GPL'd source uses. It's like cops putting out a plate of free 'special' (unmarked as such) brownies next to a plate of $5-per regular brownies at back-to-school night and promptly arresting everybody who eats one of the 'free' brownies.

If Oracle pulled such a BS claim out in their Java lawsuits, everybody but the corporate lawyers would be puking in disgust at such a bold admission of intent to entrap users.

I believe Larry Rosen's warning to learn the facts carefully applies here. XimpleHelp's argument is not that the GPL license did not include a license to use the software. The problem is more complicated than that. XimpleHelp's argument, as I understand it, is that the software was offered under two terms: one: you could abide by the GPL and use it (and redistributed it under certain conditions) for free. Two: you could buy a commercial license and use (and presumably redistribute) the software without any need to follow the GPL. The VDT-XML distribution site is pretty clear on this: it took me only a couple minutes to find and read the relevant part of the FAQ:

* Can you explain the GPL license a bit more?
The GPL does not necessarily require one to disclose their source code when modifying a GPL-covered work or using GPL-covered code in a new work. This requirement arises only when the new project is "distributed" to third parties. If the resulting software is kept only for use by the modifier, no disclosure of source code is required. Although VTD-XML is protected by US patents 7133857, 7260652, and 7761459, as long as you abide by GPL, you don't have to worry about patent infringement.
All licenses to any parties in litigation with XimpleWare have been expressly terminated. No new license, and no renewal of any revoked license, is granted to those parties as a result of re-downloading software from this or any other website
If you don't like the restriction of GPL, XimpleWare also offers flexible commercial licenses for VTD-XML. Please email us at sales@ximpleware.com for more details.

XimpleHelp's legal argument as I understand it is that Versata violated the GPL when it used VDT-XML and *redistributed* the software in modified form without subjecting the derivative software to the terms of the GPL. That means effectively Versata did not have a valid license to VDT-XML, because they broke the GPL which granted it in the first place. Without that license, Versata was now not just in violation of the GPL, but also now violating XimpleWare's patent rights of the software - because Versata was using patent-protected software without permission.

Versata's customers may not have the right to estoppel they think they do, for the reason Rosen specifies: the GPL *would have* offered some protection to those customers if Versata itself had been compliant with the GPL. But since they are not, the GPL doesn't apply to Versata and neither does it apply to its customers - except insofar as they are in breach of it.

Addressing your analogy, nothing prevents Versata's customers themselves from downloading VDT-XML (or would have, before Versata terminated their ability to get a license because of the lawsuits) and using it, and nothing prevents anyone else from downloading VDT-XML and using it free from patent infringement allegations. If XimpleHelp tried to sue me for violating its patents just because I downloaded and used VDT-XML, they'd almost certainly lose that case both on legal merits and also because they explicitly said on their distribution site they would not do

XimpleHelp's legal argument as I understand it is that Versata violated the GPL when it used VDT-XML and *redistributed* the software in modified form without subjecting the derivative software to the terms of the GPL. That means effectively Versata did not have a valid license to VDT-XML, because they broke the GPL which granted it in the first place. Without that license, Versata was now not just in violation of the GPL, but also now violating XimpleWare's patent rights of the software - because Versata was using patent-protected software without permission.

XimpleHelp's legal argument is wacky. Either Versata agreed to abide by the GPL (in which case they're liable to damages to XimpleHelp for violating the contract but are not liable for copyright or patent infringement since they had a valid contract for them) or they did not agree to abide by the GPL (in which case they're liable for damages due to copyright and patent infringement but not liable for any breach of contract). It's one or the other, not a mix and match free-for-all from both.

I haven't read the GPL recently, but I suspect patent rights are limited to the software being licensed - so in your scenario the customers would have patent rights to use the GPLed copy of XimpleHelp, but still NOT have any patent rights with respect to the infringing software from Vyatta, for which they *only* have a license from Vyatta.

"If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program."

However, If XimpleWare granted a patent license or non-enforcment covenant to derivative GPL works (as I believe is the claim) the issue becomes moot - anyone using the code under the GPL license gets a patent license automatically - so no additional restrictions are imposed. However, as soon as the GPL is violated the patent license is likewise null and void, so that you are infringing both the copyrights and patents on the software(at least that's how I'd expect the patent license to be written).

Either Versata agreed to abide by the GPL (in which case they're liable to damages to XimpleHelp for violating the contract but are not liable for copyright or patent infringement since they had a valid contract for them)

If they violated the contract, then they don't have a valid contract for anything.

Except that we're not talking about a contract, but a license. There are ways of dealing with contract violations, but they don't involve immediately rendering the contract invalid. However, if they violated the terms of the license, they didn't have a valid license for anything.

If you don't like the restriction of GPL, XimpleWare also offers flexible commercial licenses for VTD-XML [contact info follows]

The software is distributed for free provided certain license terms are followed, and otherwise, a license can be purchased for it as a commercial product. This seems to be a case where the GPL-licensed version of the software was inappropriate, and Versata should've paid for a license. I think that it can be argued that there are real damages in this case.

You don't award damages on stuff that is being released for free, but copyright infringement is still against the law, and there can be punative damages, payable to the state, for ignoring it. Willfull disregard of copyright has exponentially higher fines associated with it. The only damages I would expect that could be claimed by the copyright holder in such a case are their legal fees involved with them bringing the case before the court in the first place (which would, of course, have to be entirely p

IAAL (and I have litigated GPLv2 cases unlike most IP attorneys). Anyway, the current case law says that breaching the GPLv2 is actionable as a copyright violation. Depending on when the code was copyrighted, such violations carry their own statutory penalties (upwards of $150,000 per copyright violated if it qualifies as willful infringement), plus the more important punishment of attorney's fees. Basically, failing under the copyright act gives a plaintiff the ability to club the defendant with massive bi

The difference is that the code is distributed for free. No judge is going to award damages for the redistribution of something that is free.

If you sue under US law there's statutory damages, the kind that lets the RIAA/MPAA charge a $750 minimum (that can go down to $200 if you're an innocent infringer) and $150,000 maximum per work. Make that $250,000 and up to 5 years in prison if you can show it was for profit, which shouldn't be a problem in this case. If they can hire a lawyer to get a $10,000/song verdict for a 99 cent product, surely you can make up some imaginary numbers of lost commercial licenses too. However that's got nothing to do

The difference is that the code is distributed for free. No judge is going to award damages for the redistribution of something that is free. At least, not actual damages, like $$$ per infringing copy. The breach of the terms (like not redistributing the source code) could be translated to some punitive damages, perhaps.

Copyright law explicitly provides for statutory damages of up to $250,000 per copy, precisely so that authors who are ripped off do not have to definitely prove exactly how much they lost.

Nonesense. The code is distributed with the expectation of payment in kind, namely providing your source code as well. At a minimum, your source code that you're trying to keep closed has a monetary value which you deprived the GPL author of.

Nonsense. The GPL is especially used against finance-driven development. You "pay" by being a human instead of a robotic bean counter. The GPL states other demands than monetary. The GPL exist to fight money based extortions. The damages are damages against humanity. These damages are more real than the dollars you want to express them in.

The copyright part of the GPLv2 doesn't allow that remedy, but the GPL isn't just a statement of copyright, but is also a license, and the license part of the GPLv2, which you agree to if you use GPL code, does specify what must happen if GPLv2 code is incorporated.

And if software companies are suddenly saying licenses aren't enforceable, then wow, we've entered a brand new age.

The copyright part of the GPLv2 doesn't allow that remedy, but the GPL isn't just a statement of copyright, but is also a license, and the license part of the GPLv2, which you agree to if you use GPL code, does specify what must happen if GPLv2 code is incorporated.

So if they used a non-gpl library from microsoft in their code, or paid for a 3rd party license what then? The court is going to force them to GPL and distribute those as well? That's just asinine. It would NEVER happen. It doesn't even make sens

The GPL does state that if you cannot meet the terms of the license by distributing the source code for the entire program (DLLs and all) then you aren't allowed to distribute it.

The GPL at that point is just re-stating copyright law.

This was a smart move on Ximpleware's part, as it does have the impact of essentially "infecting" Versata's entire codebase unless they are granted a commercial license (the hammer to the commercial license carrot).

No, it has NOTHING to do with "infection". That is a FALSE concept, a LIE perpetuated by MicroSoft to discredit the GPL. There IS NO SUCH THING AS "infection".

What the LGPL does is give you some more methods of distributing the code without violating copyright. It has nothing to do with the punishment if you violate copyright, which does not change in one bit! And that punishment does NOT include 'you are forced to distribute stuff you have copyright on for free'. It just does not contain that in any law in

Copyright violation conviction results in having to pay monetary damages to the copyright holder, and to cease redistribution of the copyrighted work.

Fulfilling the requirements of the LGPL on new copies in no way is required by, and conversely also does not get you out of, the punishment. Therefore for every possible reason in the book this "viral" idea is false.

No. You only agree if you agree, by say, signing an agreement. If you use GPL in violation of the license, and you have never agreed to that license, then you are in violation of copyright law, not contract law.

Thanks to the Supreme Court of the United States, one does not have to physically sign any agreement to be bound by it. Use alone, such as putting a commercially-produced DVD in a DVD player, is sufficient for you to have agreed to the terms.

The license gives rules that you must follow if you don't want to violate the copyright. There are other ways of not violating the copyright, an easy one is to not distribute a copy at all!

The license is enforceable. If you don't follow it you have VIOLATED COPYRIGHT, which is against the law.

But you are making the bogus and false statement that the punishment for violating copyright is to force you to continue distributing it but obey the license. That is FALSE. The punishment for violatin

Licenses are enforceable -- if you agreed to them. Presumably XimpleHelp doesn't have a signed agreement from Vyatta. Did Vyatta stipulate to using the XimpleHelp software under it's GPL license or is that a disputed fact? If disputed then it's just as likely that we're looking and plain-jane infringement for which the GPL and its terms are irrelevant. Infringement is cured with cash and injunctions. Nothing else, just cash and injunctions.

As far as acceptance of the license goes, it doesn't matter where they steal the source from, the license is not automatically accepted. The GPL is funky that way: one part tries to say it can be automatically accepted, another part concedes that it isn't, and the law everywhere in the US except two states says it isn't.

Yes, people get very confused by the fact that nearly all of the headline grabbing GPL enforcement actions to date have "settled" for coming into compliance, with occasional "donations" to GPL enforcement bodies. Remember, a settlement is usually an out of court agreement between the parties to terminate or withdraw legal action, and never involves actually settling the law at hand, and a settlement generally doesn't need to comply the law.

1. Versata produced software 'DCM' incorporating Ximpleware's GPLv2 licensed code.2. Versata licensed DCM to Ameriprise, who then distributed copies to it's independent contractors.3. Ximpleware's code is subject to patent claims in the USA, making distribution under GPLv2 impermissible, and Versata did not have a commercial license, making Versata's distribution of Ximpleware's code unlicensed (in the USA).4. Ameriprise was not aware of (1) or (2) until discovery related to a lawsuit between Versata and Ameriprise.

If this is correct, I can see where Ximpleware has a copyright claim against Versata, but I don't see where Ximpleware has a copyright claim against Ameriprise for any distribution of DCM to it's contractors. Strictly speaking, I suppose Ameriprise did distribute copies of Ximpleware's code, but if they did so under good-faith belief that they had appropriately licensed DCM from Versata, I can not see it being reasonable to hold Ameriprise liable.

At the risk of a possible bad analogy, if Google included undocumented unlicensed code in Android, I would not consider it reasonable to hold each phone vendor liable for infringement, either.

"Good Faith" helps reduce your damages in a patent claim, but mere use of patented software (much less distribution) leaves you open to patent claims, independent of copyright claims.

And yes, this is a problem with software patents. Both the distributor and end users are vulnerable to claims.

Android is indeed tied up in all sorts of patents, and every phone vendor has to pay up licensing fees, including to Microsoft. (As of a couple years ago, MS made about 10x their Windows Phone revenue just from Androi

Perhaps simplistic, but mere possession of stolen goods is an indictable offense. It does not matter whether you were under the impression that the fence owned the items you bought; they're stolen, and you can't keep them.

XimpleWare was apparently of the opinion that using the GPLv2 license carried along a patent license, whether implicit or explicit. In that case, it could be redistributed under the GPLv2, but any distribution or copying not compliant with the GPLv2 would violate not only copyright but patents.

Ameriprise did distribute copies of XimpleWare's code without proper license. If they'd merely used copies they got from Versata, they'd be in a much better position. If the contract with Versata contained an in

You distribute compiled code with GPL integrated, without complying with the GPL.

If this is discovered, then your customer has no right at all under the GPL to your whole code, and the GPL can never give them any rights.

The only way you can come into compliance with the GPL is to distribute sources for the whole blob - but in practice what has to happen to compel you to do this is for you to either decide that it is easier doing this than going to court - or for an author of the GPL code (or for the FSF where authorship has been assigned) to take court action for violating the licence - and then for the court to as the penalty require the release of source code.The court is much more likely to go for financial damages - as that's what they know.

That depends. If your customer can prove that you accepted the GPL license for the code you later integrated into your product then that license flowed to them with the copy of the binary and they have the right to demand production of your source code for the relevant binaries. Proof such as an email chain discussing the GPL where you explicitly acknowledge that you acquired the code under that license. Which the customer gains access to through discovery.

Actually, no, you can't come into compliance with GPLv2 by retroactively following it. If you've violated it, you no longer have a license (GPLv3 has provisions for coming into compliance again, but GPLv2 doesn't).

You can either accept the injunction from further distribution and pay what the court says to, or you can negotiate with the copyright holder(s). In many cases, the violator has negotiated a settlement in which they provided some guarantees that they would relicense the already distributed co

Odds are high that the remedy will simply be to cease distribution and fix the problem. Perhaps some court costs and settlement money.

The odds the court would require them to release the source for everything under the GPL is almost laughably absurd.

For starters that would almost invariably trigger a bunch of OTHER license violations for other libraries and packages they used. No court is going to enforce the GPL by demanding the company violate all its other suppliers licenses. Its just ridiculous on its f

The odds the court would require them to release the source for everything under the GPL is almost laughably absurd.

Agree... But terms of the GPL says that if you violated it the license is revoked.
By my interpretation that means that once violated you don't have a license, and complying with GPL terms after the fact has no effect.

Thus, the case is reduced to somebody using software for which they don't have a license.

I'm pretty sure bringing yourself into compliance won't change the fact that the license was revoked. But most vendors might be willing to extend a new GPL license to you, if you comply with the terms

... the GPL cannot compel you to realease your own source code for free, no matter what you do.

It can, however, make you guilty of copyright infringement if you don't comply (since permission to copy the work does not exist if you don't agree to the terms of the GPL), and this can result in a legally sustainable C&D against the distribution of any and all products by the company which utilize the GPL code in a noncompliant fashion until either all of the GPL code is removed, the code is released, or else alternative licensing arrangements can be made. Exact damages awarded to the copyright holder, if any, would probably be at the discretion of the court, but even if there were none, the company that infringed on the copyright would still have a fine for violating copyright law, payable to the state, and the amount applicable would escalate quickly if or when any willful infringement can be shown. so it's really not in anyone's best interests to go around ignoring it.

Sigh. Copyright is a dessert topping AND a floor wax. If somebody violates your copyright, you can sue them in civil court. Certain copyright violations are also Federal crimes, although not all infringements are.

Fair point... you are right it's not the GPL itself that makes one guilty of copyright infringement, it's their own actions of copying the work without permission. The GPL only explicitly states that permission will not be given to copy the work if one does not agree to its terms, which is how it might feel like it's the GPL's terms that cause copyright infringement, but you are absolutely right. It's not the GPL's wording that causes this, it's the infringer's own actions.

The GPL has behind it an altruistic notion. That is, that your code can be extended and improved and will still remain free. I've always been of the view that it is even more altruistic to let people do what they wish with my code, even if that means closing it off in proprietary products, not acknowledging my efforts, and making money off of it while not giving any back to me.

If a company does make money of of my code, then great, I hope they create lots o

Umm, the point of the GPL is not altruism. It is to create software that the end user has the right to inspect and modify. So yes, if altruism is your goal, public domain your code and be done with it (this works perfectly well for, say, SQLite).

The point of the GPL is indeed altruism. It's a different approach than the BSD, but both are altruistic in that they allow people to do things with the code freely. Public domain, on the other hand, is legally troublesome, particularly in some countries. If you want anybody to use the code for whatever use the BSD license or the WTF license or something like that.

(For the sake of disclosure, IAAL, I am a software developer, I have written GPLv2 code, and I have litigated GPLv2 cases, but I have absolutely zero involvement in this matter)

The question here is really just the classic question of the morality and mentality of the free/opensource (I'll just say opensource from this point) movement vs. the harsh realities of patent and copyright law. The author above, and the author of the mentioned article, pitch this as some triumphant fight for the glory of something-or-other, but the truth is that it's: 1) a money grab, 2) a principled fight to teach violators a lesson, or 3) a some combination of both. Having reviewed the litigation tactics here; I have to lean towards money grab.

That said, having intimate knowledge of both sides of the equation here (opensource development ideas and IP attorney mentalities), I can attest that the ideals employed by both sides are, generally, diametrically opposed. Is Ximpleware is right, legally, in the fact that it can release a GPLv2'd software, file patents on the ideas, and then sue the living pants off everyone for patent violations? Frankly, yes because IP laws are harsh and designed to be massive swords. Still, the defendants have decent equitable arguments for estoppel under their implied license/baiting arguments which have precedent in the realm of copyrights. Outside the legalities, is it morally right as an opensource developer? No, probably not.

Suing the hell out of a violator? Go for it. Suing the hell out of a customer with knowledge of the infringement: Sure, why the hell not. But sending off lawsuits to unwitting customers who simply purchased a product they didn't know was infringing? Now you're pushing the line. Such actions have real world consequences. The litigation of these cases is extremely expensive, extremely time consuming, and a corporation must hire representation in U.S. courts (they cannot appear pro se). Most attorneys ignore those realities because, frankly, the suffering of a defendant is of no concern. The only thing that matters is whether the case is meritorious; if so, I'm suing the living pants off you because the law says I can. The motto is typically summarized as: legal, not ethical. But is that what the opensource world wants to present?

Mr. Rosen throws around "indemnification" and "diligent" arguments to justify the lampooning of what most people would consider "innocent" parties, but they're shill arguments at best. The simple truth, is that you're not furthering the opensource movement in any way. As for indemnification, it is a farce. First, it's speculative that any such agreement exists. Second, the indemnitor needs to: 1) agree to honor it's obligation; 2) have the resources to honor it's obligation; and 3) actually honor the obligations. The reality is that a request for indemnification is just as likely to result in more lawsuits, as it is to result in a resolution for the downstream users. Beyond that, if original defendant files for bankruptcy, indemnification is worth absolutely squat. As for "due diligence," any software engineer will readily admit, it is nearly impossible (especially for small to mid-sized firms that are letting non-technical staff handle acquisitions). It's not impossible, just cost prohibitive. Ask yourself, What purpose does destroying a company serve to the greater cause of opensource? Is it legally viable, sure, but is it worth it, morally?

All that to say, I wish people would stop trying to co-opt grand ideals and sugar coating these types of cases. The plaintiff has sued the living hell out of everyone because, legally, they can. In turn, those actions makes settlement more likely, since the upstream infringer is now getting complaints from his clients and costs are rapidly mounting up. Was it legal? Sure. Was it moral and in-line with the opensource movement's ideals? Well, that really depends on what side of the line you fall on. But regardless of where you are on that line, is possibly destroying the lives (yes, personal live

The code is not produced by a charity; it is produced by a business. From the perspective of a business, the GPL is a marketing tool -- a great marketing tool. "Here's the source; try it out! Talk to others who are using it! Just contact us if you want to merge it with your proprietary code and make money!"

Any business can use the GPL this way, and many have. Just because a business uses the GPL does not mean that their

Thank you for your analysis, but it seems to me that Ameriprise is not just a customer. They're also a distributor of GPLed software not in accordance with the GPL. It seems to me that the plaintiff would have every legal and moral right to at least get an injunction against further distribution. I don't know if there were any lawsuits against anybody for just receiving the software.

This is also a commercial case, since the software is dual-licensed. The plaintiff would normally have collected mone

It is unlikely that many business owners know or could know without great effort and expense whether any defects in license or ownership exist when they purchase software. I think that before any punishments or fines can take place there must be some evidence that a person is doing wrong knowingly. The intellectual property mess with all its complexity and legal issues should not be put upon the end user of the product who in many cases has no way to know or even find out if he is doing wrong. Kee

While I largely agree with you, this is a problem completely unrelated to F/OS licenses.

For many things, a violation is a violation whether somebody knows it is a violation or not. Ameriprise clearly wasn't willfully or knowingly violating copyright and maybe patent law, but they don't get a free pass just because they didn't know (just reduced penalties). Otherwise, a company could acquire software or other copyrighted and/or patented material through a small "burner" company that could be left to go

Versata chose to steal the code instead of licensing it under
the commercial license or the GPL. Just because the GPL allowed
the thieves to legally look at the code or use it unmodified does
not magically transform this into a nightmare scenario. They
are not being forced to either abandon their project or
release their own code. They could just buy the commercial
license like any responsible grownup would do.

The claim that this is a GPL nightmare scenario is just a stupid
lawyer trick to try to f

1. Implied - Not directly expressed.
Patent - A patent is an exclusive right to a particular invention.
License - permission to do what what otherwise be illegal.

IF a company gives you permission to do something that would otherwise violate patent law, you have a patent license for that task even if not patent was specifically mentioned. If Microsoft entered into a contract with me to manufacture android devices for their employees, that can't turn around a sue me for patent infringement of those spec

The GPL has generally been held to be a copyright license, and that disregarding it is a copyright violation.

The law on loading into RAM or whatever is, IIRC, that copyright is not infringed by copying necessary for use of software obtained legally. Personally, I think it should be legal regardless (I'm not liable for copying words into my retina or brain if I'm reading an illegally copied book), but that's another topic. There's also the question of what the plaintiff is suing for; if a plaintiff is n

The only thing I don't quite understand is the possible motivation for XimpleWare to only sue for patent infringement, but not for copyright infringement. It's not like you have to choose between the two (you can have both), and anyway it seems that a copyright claim would be quite strong.

Maybe it's just to keep the lawsuit more contained and therefore save in attorney's fees and costs? On the other hand it seems to me that only claiming patent infringement encourages the defendants to challenge the validit

RMS invented the GPL because of copyright issues, and before software patents became a problem.

As I understand it: It was a (brilliant) workaround for two problems with putting software in the public domain, which releases ALL rights:

- Derived works: Somebody makes a modified version and copyrights that. They do a bugfix or enhancement and even the original author is locked out of his own software's future. He can't do the same bugfix or a similar enhancement without violating the new copyright. Similarly with other users of the software.

- Compilation copyrights: If somebody combines several public domain works into a combined work, they can copyright THAT, claiming violation if somebody uses excerpts from it - such as some of the original public-domain components or excerpts from them. In book publishing this covers publishers of collections and anthologies. In software, including a public-domained module in a library or distribution would let the distributors of that lock up the rights to the components. Again the original author and other users can get locked out of the author's own work. (For instance, nobody else could include it in a similar library or distribution.)

Stallman's trick solution was to keep the original work under copyright, but license it under terms that require derived works to also be licensed under the same terms and source to be included with obect. Expiration of the copyright might cause a problem - but with companies like Disney on the job lobbying congress, that's probably not going to happen in the US as long as there IS a US. Alternatively, eliminating copyrightability of software would also eliminate the need for the GPL.

Public domain gives you Freedom 0 (the right to run the software), and Freedom 2 (the right to copy and distribute it), but not Freedom 1 (the right to study how the software works) or Freedom 3 (the right to modify it).

If that was the case, then nobody would ever be able to write any software because everyone at some point has looked at GPL'd code. I don't think there has ever been a case where someone was accused of GPL infringement because they might've looked at some GPL source code at some point in their life.

Even if that were true, it wouldn't be a GPL-only issue. Nobody who had ever written code for commercial use could ever change jobs again because they might accidentally copy something and their new employer would be in trouble.

First of all, source copyrights only cover the literal, copyrighted source itself (as well as comments and documentation). They do not cover functionality, API, ABI or any but the most literal and direct of language ports.

Second, as a developer, the GPL protects my rights in ways that public domain cannot. If I release a piece of code under the GPL, I remain free to grant or sell other licenses to my software as I please. At the same time, if users wish to release modifications

Actually, section 7 of the GPL says "If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all."

So, if Ximpleware intentionally distributed the software under the GPLv2 (they did) and held the patents (they did) then either they must have intended that any recipient of the software under the GPLv2 also receive a license to use the patents or they deliberately breached the G

Actually, section 7 of the GPL says "If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all."

So, if Ximpleware intentionally distributed the software under the GPLv2 (they did) and held the patents (they did) then either they must have intended that any recipient of the software under the GPLv2 also receive a license to use the patents or they deliberately breached the GPL contract with every single person who downloaded the code making them (Ximpleware) liable for damages from any of those users who are otherwise compliant with the terms of the license.

Either way, the court might reasonably cure Ximpleware's problem by affirming the existence of a patent license to everyone legitimately using the code under the GPL.

If the court says Versata got a patent license when legitimately using the code under the GPL, that does not do much to protect Versata since they do not seem to be legitimately using the code under the GPL - certainly none of their customers knew the code was supposedly GPLed, which seems to be the entire point of this case.

Actually, XimpleWare can distribute any of its code under any provisions it wants. It can give you a copy under the GPLv2, and point out you can't actually redistribute under it. What they apparently meant to do is provide an implicit patent license, although apparently that's legally iffy.

I think you are absolutely correct. The only time you should "accept" the GPL as a contract is when you download or receive the source code. If those Windows installers include the source code, then the click-through agreement is OK, in my opinion.

On second thought, my reasoning is incorrect. You could just as easily link to an already compiled GPL library and distribute it. So the click-through agreement might be necessary, if you imagine all the possibilities.